CVE-2026-73248
HighCVSS 8.5Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
Calibre before version 9.12.0 processes attacker-controlled composite_template metadata from malicious EPUB, OPF, PDF, or similar files through program: and a nested template() call whose formatter does not inherit allow_python_templates=False, allowing a nested python: template to reach compile_python_template and execute arbitrary Python code when the file is opened or imported. This issue is fixed in version 9.12.0.
Risk Assessment
A user opening a malicious e-book file could allow arbitrary code execution on their machine, potentially leading to system compromise or data theft.
Recommendation
Update Calibre to version 9.12.0 or later. Avoid opening e-book files from untrusted sources.
Other vulnerabilities in Calibre
See all- CVE-2026-73249High
calibre is an e-book manager. Prior to 9.12.0, the calibre Content Server endpoint POST /book-update-annotations/{library_id}/{book_id}/{fmt} in src/calibre/srv/books.py omits needs_db_write=True, causing Router.dispatch() to skip ctx.check_for_write_access() before update_annotations() passes attacker-controlled JSON to db.merge_annotations_for_book(), which allows a readonly user or an anonymous user on an unauthenticated deployment to persist unauthorized book annotation changes. This issue is fixed in version 9.12.0.
- CVE-2026-53511High
A vulnerability in calibre prior to version 9.10.0 allows arbitrary Python code execution via a malicious EPUB, OPF, or PDF file. An attacker can embed a custom column definition with a python: template in calibre:user_metadata that is passed unsanitized to exec() in the template formatter.
- CVE-2026-33206Medium
Prior to version 9.6.0, calibre has a path traversal vulnerability in handling images in Markdown and similar text-based files, allowing inclusion of arbitrary files from the file system into the converted book. Missing authentication and SSRF in the background-image endpoint of the ebook reader web view allow exfiltration without additional interaction.
- CVE-2026-33205Medium
calibre contains a Server-Side Request Forgery vulnerability in the background-image endpoint of its web view. An attacker can perform blind GET requests to arbitrary URLs and exfiltrate information out of the ebook sandbox. Version 9.6.0 patches the issue.
Original NVD description (English source)
calibre is an e-book manager. Prior to 9.12.0, calibre processes attacker-controlled composite_template metadata from a malicious EPUB, OPF, PDF, or similar file through program: and a nested template() call whose formatter does not inherit allow_python_templates=False, allowing a nested python: template to reach compile_python_template and execute arbitrary Python code when the file is opened or imported. This issue is fixed in version 9.12.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS